CVE-2026-119079Krb5: mit krb5 kdc unauthenticated cpu dos via quadratic asn.1 sequence of decoding

Description

decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP.

Timeline

Scores

EPSS (exploitation in 30 days)

0.85% · top 41% of all CVEs (13 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Affected products

• Red Hat · Red Hat Enterprise Linux 10

  • unaffected 0:1.21.3-11.el10_3.2 – < *

• Red Hat · Red Hat Enterprise Linux 10.2 Extended Update Support

  • unaffected 0:1.21.3-10.el10_2.2 – < *

• Red Hat · Red Hat Enterprise Linux 9

  • unaffected 0:1.21.1-10.el9_9.2 – < *

• Red Hat · Red Hat Enterprise Linux 9

  • unaffected 0:1.21.1-10.el9_9.2 – < *

• Red Hat · Red Hat Enterprise Linux 9.8 Extended Update Support

  • unaffected 0:1.21.1-10.el9_8.3 – < *

• Red Hat · Red Hat Hardened Images

  • unaffected 1.22.3-0.1.hum1 – < *

• Red Hat · Red Hat Enterprise Linux 6

  All versions: unknown

• Red Hat · Red Hat Enterprise Linux 7

  All versions: affected

• Red Hat · Red Hat Enterprise Linux 8

  All versions: affected

What to do

Workaround: Restrict incoming TCP traffic on port 88 to trusted internal networks or authorized administrative hosts using firewalld. 1. Add a rich rule permitting TCP port 88 only from trusted networks (substitute with the appropriate network CIDR): firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="88" protocol="tcp" accept' 2. Ensure unauthenticated or public access to port 88/tcp is removed: firewall-cmd --permanent --remove-port=88/tcp 3. Apply the changes: firewall-cmd --reload Warning: Applying firewall changes requires reloading firewalld, which may temporarily disrupt network traffic. Restricting TCP access will prevent clients outside the allowed network range from falling back to TCP for large Kerberos ticket exchanges.

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-120226 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-119079](https://cveledger.app/badge/CVE-2026-119079.svg)](https://cveledger.app/cve/CVE-2026-119079)

Record last updated 13 Nov 2026, 12:38 UTC.